ROBOT (Return Of Bleichenbacher's Oracle Threat)

ROBOT was published in December 2017 by Hanno Böck, Juraj Somorovsky and Craig Young. In 1998 Daniel Bleichenbacher showed that if a server reveals whether a decrypted RSA PKCS #1 v1.5 message has valid padding, an attacker can use many adaptive queries to decrypt a ciphertext or produce a signature with the server's key. TLS specifications have included countermeasures since then, but the ROBOT team found products from several major vendors, including load balancers and TLS accelerators, that still leaked the oracle through different alerts, timeouts or connection behavior. It is tracked under several vendor-specific CVEs rather than a single one.

Why it matters

A TLS session that used RSA key exchange could be decrypted after the fact by an attacker who recorded it and could still query the vulnerable server, and the server's key could be misused to sign data. Patching the affected products closes the specific oracle, but the durable fix is to stop using RSA key exchange: disable suites named TLS_RSA_WITH_* (OpenSSL names such as AES128-GCM-SHA256) and keep only ECDHE suites, which also provide forward secrecy. TLS 1.3 removed RSA key exchange entirely. RSA certificates remain fine for signatures in ECDHE_RSA suites.

Example

nmap --script ssl-enum-ciphers -p 443 example.com | grep 'TLS_RSA_WITH'

No output means no RSA key exchange suites are offered. An nginx list with ECDHE only:

ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

Common misconceptions

• ROBOT means RSA certificates are broken. The issue is RSA key exchange (encryption), not RSA signatures; an RSA certificate used with ECDHE is not affected.
• Bleichenbacher's attack was solved in 1998. Countermeasures existed, but implementations kept getting the details wrong, which is exactly what ROBOT demonstrated.
• Only obscure servers were affected. Products from well-known vendors, and some high-traffic websites, were vulnerable at disclosure.